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Claims 

What is claimed is: 



1 1 . A method for optimizing a selection of risk controls based upon 

2 maximizing the economic value added within a client's given risk control 

3 budget, wherein said method comprises the following steps: 

4 identifying and measuring risks; 

5 creating at least one risk control system based upon said risks; 

6 determining the economic value added of each risk control system; 

7 and 

Q 8 selecting an optimal risk control system that has a maximum 

Q 9 economic value added based upon the determining step. 

Ft i 

U1 1 2. The method according to claim 1, wherein the step of identifying 

jz 2 and measuring risks further includes the steps of 

* 5 3 creating and storing lists of parameterized risks; and 

\f* 4 preparing a client risk profile, said client risk profile including said 

ry 

fQ 5 lists of parameterized risk that are applicable to said client. 

O 

1 3. The method according to claim 2, wherein said lists of 

2 parameterized risks are classified and arranged by at least industry type, 

3 organizational structure, organizational objective, and functional 

4 segments within each industry type. 



1 4. The method according to claim 2, wherein the step of identifying 

2 and measuring risks further includes the steps of 

3 inputting client characteristics and applying scaling factors to said 

4 client risk profile; and 

5 measuring said risks based upon each risk's exposure. 
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5. The method according to claim 3, wherein the step of identifying 
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and measuring risks further includes the steps of 

inputting client characteristics and applying scaling factors to said 
client risk profile; and 

measuring said risks based upon each risk's exposure. 

6. The method according to claim 4, wherein said risk exposures 
are estimated from an analysis of loss distribution functions of each risk. 

7. The method according to claim 5, wherein said risk exposures 
are estimated from an analysis of loss distribution functions of each risk. 

8. The method according to claim 4, wherein the step of identifying 
and measuring risks further includes the steps of 

creating and storing parameterized models of the risk exposure of 
said risks, wherein said parameterized models are scaleable based upon 
various exposure units; and 

creating and storing a client composite risk model based upon said 
parameterized models of the risk exposure of said risks, wherein said 
client composite risk model incorporates all of said risks affecting said 
client. 

9. The method according to claim 7, wherein the step of identifying 
and measuring risks further includes the steps of 

creating and storing parameterized models of the risk exposure of 
said risks, wherein said parameterized models are scaleable based upon 
various exposure units; and 

creating and storing a client composite risk model based upon said 
parameterized models of the risk exposure of said risks, wherein said 
client composite risk model incorporates all of said risks affecting said 
client. 
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1 10. The method according to claim 9, wherein the client composite 

2 risk model is based upon client specific characteristics of at least 

3 industry type, organizational structure, organizational objectives and 

4 functional segment within each industry type. 

1 11. The method according to claim 10, further including the step 

2 of calculating a total risk exposure, Et, for said client composite risk 

3 model. 

1 12. The method according to claim 1, wherein the step of creating 
J2 at least one risk control system further includes the steps of 

j\ 3 creating and storing sets of parameterized management risk 

fU 4 control models for said risks; 

II I 

Cj 5 creating and storing sets of parameterized specific risk control 

^ 6 models for said risks; and 

H 7 combining said sets of parameterized management risk and specific 

ry 8 risk control models into at least one risk control system. 

p 

P 1 13. The method according to claim 11, wherein the step of creating 

2 at least one risk control system further includes the steps of 

3 creating and storing sets of parameterized management risk 

4 control models for said risks; 

5 creating and storing sets of parameterized specific risk control 

6 models for said risks; and 

7 combining said sets of parameterized management risk and specific 

8 risk control models into at least one risk control system. 

1 14. The method according to claim 13, wherein said final risk 

2 control system includes sets of parameterized management risk and 

3 specific risk control models for each risk model included in said client 

4 composite risk model. 
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15. The method according to claim 12, each parameterized set of 
management risk controls, Mi, includes parameter values, said parameter 
values include 

a production efficiency value, pi, stated per a pre-defined unit 
characteristic of the client for the production efficiency value, pi-unit; 
a direct exposure reduction factor, di\ 
a management efficiency factor, xe, 

a cost factor, Ci, state per a pre-defined unit characteristic of the 
client for the cost factor, a-unit; and 

a time interval, U, required to implement each management risk 
control, m*. 

16. The method according to claim 12, each parameterized set of 
specific risk controls, S,, includes parameter values, said parameter 
values include 

a production efficiency factor, 0j 9 stated per a pre-defined unit 
characteristic of the client for the production efficiency value, 6j-unit; 

a percent reduction in exposure, bj, obtained by each specific risk 
control, sy, if said risk control operates correctly over an entire life of each 
risk control; 

a cost factor, £/, stated per a pre-defined unit characteristic of the 
client for the cost factor, ej-unit; and 

a time interval, mj, required to implement each specific risk control. 

17. The method according to claim 14, each parameterized set of 
management risk controls, Mi, includes parameter values, said parameter 
values include 

a production efficiency value, pi, stated per a pre-defined unit 
characteristic of the client for the production efficiency value, pi-unit; 
a direct exposure reduction factor, di\ 
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7 a management efficiency factor, xc, 

8 a cost factor, a, state per a pre-defined unit characteristic of the 

9 client for the cost factor, a-unit; and 

10 a time interval, U 9 required to implement each management risk 

11 control, mu 

1 18. The method according to claim 14, each parameterized set of 

2 specific risk controls, Sy, includes parameter values, said parameter 

3 values include 

4 a production efficiency factor, 0j, stated per a pre-defined unit 
2 5 characteristic of the client for the production efficiency value, 6j-unit; 

j\ 6 a percent reduction in exposure, bj 9 obtained by each specific risk 

ry 7 control, s,, if said risk control operates correctly over an entire life of each 

til 

Cj 8 risk control; 

^ 9 a cost factor, ej, stated per a pre-defined unit characteristic of the 

s 

1 0 client for the cost factor, Sj-unit; and 

ry 11 a time interval, mj, required to implement each specific risk control. 

CO 

O 1 19. The method according to claim 18, each parameterized set of 

2 specific risk controls, Sj y includes parameter values, said parameter 

3 values include 

4 a production efficiency factor, 0y, stated per a pre-defined unit 

5 characteristic of the client for the production efficiency value, 6j-unit; 

6 a percent reduction in exposure, bj, obtained by each specific risk 

7 control, s 7 , if said risk control operates correctly over an entire life of each 

8 risk control; 

9 a cost factor, £/, stated per a pre-defined unit characteristic of the 

1 0 client for the cost factor, sj-unit; and 

11 a time interval, mj, required to implement each specific risk control. 
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1 20. The method according to claim 19, wherein the step of 

2 determining the economic value added of each risk control system, 

3 further includes the steps of 

4 calculating the economic value added of each risk control system 

5 with an algorithm which incorporates the parameters associated with 

6 said sets of management risk and specific risk controls; and 

7 selecting a final risk control system that generates a maximum 

8 value of the economic value added. 

1 21. The method according to claim 20, wherein said algorithm is 

2 used to generate the economic value added , A ! EVA, between an 

N 3 improved (Imp) risk control system and a current (Cur) risk control 

nJ 

fy 4 system, and where CTR is a corporate tax rate, C* is a cost of capital, m 

~j 5 indicates a management control, c indicates a specific risk control, and y 

^6 is years, said algorithm is defined as follows: 

3 

fU 7 A 'EVA = [{{( [E Pi ]i + [ (Edi)i • Et]- [(Eci)Vy]) • (1- CTR)} - [(Eci)i • C* ]}m + 

8 { { ([ (Exi)i • (TSiY] + [ (Exi)i . (Ebj.ej)i ] - [ (£ £j i )/y]) • (1- CTR)} 

9 - [(Eeji) • C*]}c] imp 
10 

11 [{{( [E Pi ]c + [ (Zdi)c . Ex]- [(£ci)c/y]) • (1- CTR)} - [(Ecf • C* ]}m 

12 + { { ([ (Exi)c . (Z9i)C] + [ (Exi)c . (Ebj. ej )c ] - [ (Z ej c)/y]) . (1- 

13 CTR)} - [(£ Ej C) • C*]} c ] Cur. 
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1 22. A computer-based data processing system to enable an 

2 operator to create a risk control system providing a maximum economic 

3 value, wherein said system comprises: 

4 means for storing risk models, wherein said risk models include 

5 risks and corresponding risk exposures; 

6 means for storing specific risk control models further classified and 

7 arranged by at least industry type, organizational structure, and 

8 functional segments within each industry type; 

9 means for storing management risk control models further 

Q 

^10 classified and arranged by at least industry type, organizational 

v -j 1 1 structure, and functional segments within each industry type; 

fU 

py 12 means for developing risk control systems by combining said 

vj 13 specific risk and management risk controls into at least one client 

^ 14 specific risk control system; and 

M, 15 means for determining an optimum risk control system by 

fy 16 calculating an Economic Value Added (EVA) of each client specific risk 

2 17 control system so that said operator can select the optimum risk control 

Q 1 8 system that demonstrates a maximum Economic Value Added (EVA) . 

1 23. The system according to claim 22, wherein said means for 

2 determining an optimum risk control system is a computerized device 

3 capable of processing mathematical algorithms. 

1 24. A processor- readable article of manufacture having embodied 

2 thereon software comprising a plurality of code segments that 

3 implements the method of claim 1 , in order to enable an operator to 

4 optimize a selection of specific risk controls and management risk 

5 controls into a final risk control system designed to maximize the 

6 economic value added within a client's given risk control budget. 



57 



